Analysis

  • max time kernel
    103s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    17-05-2022 08:27

General

  • Target

    a3f612973f091ab836c1aac0fd420d26.exe

  • Size

    434KB

  • MD5

    a3f612973f091ab836c1aac0fd420d26

  • SHA1

    0633fc38d5b0a365429a6584da1ba45fd760f8b5

  • SHA256

    6ccc8edcce52e621484208387d0e71da165f1578f0db95b51b8b31fb8c19cc05

  • SHA512

    34c0490247f5028f5583d3ad371db53a515adeb23ed77470a628ce2cc44592d7fa3555c65a3645c2cd7079d51cf23cace577781950acf9f27515db521d4d6425

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3f612973f091ab836c1aac0fd420d26.exe
    "C:\Users\Admin\AppData\Local\Temp\a3f612973f091ab836c1aac0fd420d26.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 2032
      2⤵
      • Program crash
      PID:4416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1092 -ip 1092
    1⤵
      PID:892

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1092-130-0x0000000002D5E000-0x0000000002D88000-memory.dmp
      Filesize

      168KB

    • memory/1092-131-0x00000000048E0000-0x0000000004917000-memory.dmp
      Filesize

      220KB

    • memory/1092-132-0x00000000074D0000-0x0000000007A74000-memory.dmp
      Filesize

      5.6MB

    • memory/1092-133-0x0000000000400000-0x0000000002B8A000-memory.dmp
      Filesize

      39.5MB

    • memory/1092-134-0x0000000007A80000-0x0000000008098000-memory.dmp
      Filesize

      6.1MB

    • memory/1092-135-0x0000000007330000-0x0000000007342000-memory.dmp
      Filesize

      72KB

    • memory/1092-136-0x0000000007350000-0x000000000745A000-memory.dmp
      Filesize

      1.0MB

    • memory/1092-137-0x0000000007460000-0x000000000749C000-memory.dmp
      Filesize

      240KB

    • memory/1092-138-0x0000000008E80000-0x0000000008EE6000-memory.dmp
      Filesize

      408KB

    • memory/1092-139-0x0000000009300000-0x0000000009376000-memory.dmp
      Filesize

      472KB

    • memory/1092-140-0x00000000093C0000-0x0000000009452000-memory.dmp
      Filesize

      584KB

    • memory/1092-141-0x00000000095F0000-0x000000000960E000-memory.dmp
      Filesize

      120KB

    • memory/1092-142-0x00000000096B0000-0x0000000009872000-memory.dmp
      Filesize

      1.8MB

    • memory/1092-143-0x0000000009880000-0x0000000009DAC000-memory.dmp
      Filesize

      5.2MB